Although the Internet has had great successes in facilitating communications between computer systems and enabling electronic commerce, the computer systems connected to the Internet have been under almost constant attack by hackers seeking to disrupt their operation. Many of the attacks seek to exploit vulnerabilities of the application programs, operating systems, and other computer programs executing on those computer systems. One of the most destructive methods of attacking a computer system has been to modify portions of the operating system with software that may perform many of the same functions of the operating system, but also includes malicious functions. These modifications can be either to replace portions of the operating system or to add new programs that are automatically started by the operating system. Such software is referred to as “malware” because of its malicious nature. Once malware is installed, the operating system is “infected” and the malware can control all aspects of the computer system. Such malware includes RootKits, Trojan horses, keystroke loggers, and so on. For example, the malware could intercept keystrokes that a user enters (e.g., a password) and report them to another computer system. As another example, the malware could be a worm that launches a self-propagating attack that exploits a vulnerability of a computer system by taking control and using that computer system to find other computer systems with the same vulnerability and launch attacks (i.e., sending the same worm) against them. To launch an attack that exploits the same vulnerability, the malware assumes that all to-be-attacked computer systems locate their resources in the same way. For example, malware may operate by overwriting an entry in a system call table so that system calls through that entry are routed to the malware. The malware may assume that the system call table is stored at the same location of each computer system or that its location can be found in the same way (i.e., indirectly through a memory location that contains a pointer to the table).
In addition to infecting an operating system, malware can also infect various applications. One virus, known as the “Slammer” virus, infects SQL server software. This virus takes control of the server by sending a SQL message that causes a buffer to overflow, which causes the data of the message to overwrite the server's stack with instructions including the address of a memory location (e.g., a return address stored in the stack) to which the SQL server jumps. When the SQL server jumps to the memory location specified by the overwritten address, the malware starts to execute. Because the SQL server executes with a high privilege level, the malware can effectively take control of the server. Once the malware takes control, it can access application and system resources to perform its malicious behavior. The Slammer virus relies on the information of each server's stack being stored in the same way so that it knows where to store its address to effect the taking over of the server.
Since all installations of a certain version of a program (e.g., application or an operating system) are typically identical, once a hacker develops malware to infect a program, that malware can be used to infect all installations of the program in the same way.